The npm package icu-messageformat was identified as containing malicious code. No specific details about the nature of the malicious code or its impact are provided in the source information. There are no affected versions explicitly stated, and no CVSS score or detailed technical analysis is available. No known exploits in the wild have been reported.